As denial-of-service attacks grow more powerful, one victim offers a bounty.

Share this story

The operator of a role-playing game site that was knocked offline by denial-of-service attacks has pledged a reward of more than $13,000 for information leading to the conviction of the people responsible.

The €10,000 bounty—equivalent to a little more than $13,000 at current exchange rates—was promised Tuesday by massively multiplayer online role-playing game provider Wurm. The bounty came after the company's servers were knocked offline by a distributed denial-of-service (DDoS) attack, a technique that uses large numbers of infected computers to flood a target with more data than it can handle. Wurm remained offline Wednesday as it switched to a new Web hosting provider. Engineers had already planned to make the switch but accelerated the time frame once its old host pulled the plug.

"Shortly after today's update we were the target of a DDoS attack and our hosting provider had to pull us off the grid for now," a Wurm representative wrote in Tuesday's post. "We will be back as soon as possible but things are out of our hands since their other customers are affected. As we wrote in a previous news post we are planning on changing hosting anyways which should improve things for the future. We can offer 10,000 Euro for any tips or evidence leading to a conviction of the person responsible for this attack."

Some of the recent attacks have gained power by exploiting weaknesses in older versions of the Network Time Protocol (NTP) that servers use to sync their clocks with the rest of the Internet. The attacks work by sending NTP requests that are manipulated to appear as if they originated with the DDoS target. The NTP servers respond with output that can be tens or hundreds of times larger than the original request, a dynamic that vastly amplifies the effect on the target. These types of high-powered reflection attacks have long been bounced off of poorly secured domain name system servers, but the abuse of NTP servers to achieve similar results is comparatively much newer.

Until now, most victims of DDoS attacks have sought the protection of CloudFlare, Prolexic, or one of the many other competing services. Wurm's promise of $13,000 represents an unusual—possibly unprecedented—remedy. It will be interesting to see if it gets results.